diff --git a/sys/dev/netif/wi/if_wi.c b/sys/dev/netif/wi/if_wi.c
--- a/sys/dev/netif/wi/if_wi.c
+++ b/sys/dev/netif/wi/if_wi.c
@@ -1353,8 +1353,16 @@
 	}
 	m->m_data += off - sizeof(struct ieee80211_frame);
 	memcpy(m->m_data, &frmhdr.wi_whdr, sizeof(struct ieee80211_frame));
-	wi_read_bap(sc, fid, sizeof(frmhdr),
-	    m->m_data + sizeof(struct ieee80211_frame), len);
+	if (wi_read_bap(sc, fid, sizeof(frmhdr),
+	    m->m_data + sizeof(struct ieee80211_frame), len) != 0) {
+		/* DF-4142: BAP read failed; the mbuf tail is uninitialized
+		 * kernel heap -- drop the frame instead of delivering it */
+		m_freem(m);
+		CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);
+		++sc->sc_ic.ic_ierrors;
+		DPRINTF(("wi_rx_intr: read fid %x body failed\n", fid));
+		return;
+	}
 	m->m_pkthdr.len = m->m_len = sizeof(struct ieee80211_frame) + len;
 
 	CSR_WRITE_2(sc, WI_EVENT_ACK, WI_EV_RX);